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Abstract 

The main component of (constructive) recognition algorithms for black 
box groups of Lie type in computational group theory is the construction 
of unipotent elements. In the existing algorithms unipotent elements are 
found by random search and therefore the running time of these algorithms 
is polynomial in the underlying field size q which makes them unfeasible 
for most practical applications 27_. Meanwhile, the input size of recogni- 
tion algorithms involves only log q. The present paper introduces a new 
approach to construction of unipotent elements in which the running time 
of the algorithm is quadratic in characteristic p of the underlying field and 
is polynomial in log q; for small values of p (which make a vast and prac- 
tically important class of problems), the complexity of these algorithms 
is polynomial in the input size. 

For PSL2(g), q = 1 mod 4, we present a Monte-Carlo algorithm which 
constructs a root subgroup U, the maximal torus T normalizing U and a 
Weyl group element w which conjugates U to its opposite. Moreover, we 
extend this result and construct Steinberg generators for the black box 
untwisted classical groups defined over a field of odd size q — p^ where 
q = 1 mod 4. Our algorithms run in time quadratic in characteristic p 
of the underlying field and polynomial in log q and the Lie rank n of the 
group. 

The case g = — 1 mod 4 requires the use of additional tools and is 
treated separately in our next paper [^. Further, and much stronger 
results can be found in [S] [7] . 
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1 Introduction and the principal results 
1.1 Black box groups 

The purpose of the present paper is to introduce an efficient algorithm which 
constructs the so-caUed Steinberg generators of black box classical groups in 
small odd characteristics; it will be used in subsequent papers [HIE] for recovery 
of the structure of these groups. 

Black box groups were introduced by Babai and Szemeredi 3 as an idealized 
setting for randomized algorithms for solving permutation and matrix group 
problems in computational group theory. 

A black box group X is a black box (or an oracle, or a device, or an algorithm) 
operating with 0-1 strings of bounded length which encrypt (not necessarily in 
a unique way) elements of some finite group G (in various classes of black box 
problems the isomorphism type of G could be known in advance or unknown). 
The functionality of the black box is specified by the following axioms: the black 
box 

BBl produces strings encrypting random elements from G; 

BB2 computes a string encrypting the product of two group elements given by 
strings or a string encrypting the inverse of an element given by a string; 
and 

BBS compares whether two strings encrypt the same element in G — therefore 
we have a canonical map (not necessarily easily computable in practice) 
TT : X ^G. 

We shall say in this situation that X is a black box over G or that X encrypts 

G. 
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A typical example is provided by a group G generated in a big matrix group 
GL„(r'^) by several matrices gi,...,gi. The product replacement algorithm 
PU] produces a sample of (almost) independent elements from a distribution 
on G which is close to the uniform distribution (see the discussion and further 
development in[Tl[l[TIllH|31[31|31l3SllSZ])- We can, of course, multiply, 
invert, compare matrices. Therefore the computer routines for these operations 
together with the sampling of the product replacement algorithm run on the 
tuple of generators (gi,. . . ,gi) can be viewed as a black box X encrypting the 
group G. The group G could be unknown — in which case we are interested in 
its isomorphism type — or it could be known, as it happens in a variety of other 
black box problems. For example, if we already know that G is isomorphic 
to, say, SL2m (?"*), we may wish to construct in G subgroups Hi = Sp2m(''*)j 
H2 = SL2m{r) and H3 ~ Sp2m(r') in such a way that Hi Ci H2 = H3. (This 
problem is actually solved in one of the subsequent papers in this series [5] . ) In 
our set-up, this means that we wish to construct black boxes Yi, i = 1,2, 3, over 
Hi and embeddings — > X. This formalism is further developed in [71 [5]. 

Notice that even in routine examples the number of elements of a matrix 
group G could be astronomical, thus making many natural questions about the 
black box X over G — for example, finding the isomorphism type or the order of 
G — inaccessible for all known deterministic methods. Even when G is cyclic and 
thus is characterized by its order, existing approaches to finding multiplicative 
orders of matrices over finite fields are conditional and involve oracles either 
for the discrete logarithm problem in finite fields or for prime factorization of 
integers. 

Nevertheless black box problems for matrix groups have a feature which 
makes them more accessible: 

BB4 We are given a global exponent of X, that is, a natural number E such 
that it is expected that = 1 for all elements x € X while computation 
of x^ is computationally feasible. 

Usually, for a black box group X arising from a subgroup in the ambient 
group GL„(r'^), the exponent of GL„(r'^) can be taken for a global exponent of 
X. 

Abusing terminology, in this paper we shall frequently identify the black box 
X and the group G encrypted hy X (as we have already done in formulation of 
Axiom BB4) ; this is relatively safe in simpler black box problems about matrix 
groups over finite fields. However, more sophisticated algorithms which we shall 
discuss in subsequent papers will require a certain level of hygiene which will 
make identification of black box groups with the groups which they encrypt 
inconvenient. 

In this paper, we assume that all our black box groups satisfy as- 
sumptions BBl-BB^. 

We emphasise that we do not assume that black box groups under consider- 
ation in this paper are given as subgroups of ambient matrix groups; thus our 



3 



approach is wider than that of the computational matrix group project |30| . 
This makes us to be a more careful with basic terminology. In particular, given 
two black boxes X, Y encrypting groups G, H, correspondingly, we say that a 
map a which assigns strings from X to strings from y is a morphism of black 
box groups, if there is a homomorphism (3 : G ^ H such that the following 
diagram is commutative: 



X 



-> Y 



G 



tty 



> H 



(here nx and Try are canonical projections of X and Y onto G and H, corre- 
spondingly). 



1.2 Black box group problems 

We shall outline an hierarchy of typical black box group problems. 

Verification Problem. Is the unknown group encrypted by a black box group 
X isomorphic to the given group G ("target group")? 

Recognition Problem. Determine the isomorphism class of the group en- 
crypted by X. 

The Verification Problem is rarely discussed in the literature on black box 
groups on its own but frequently arises as a sub-problem within more com- 
plicated Recognition Problems. The two problems have dramatically different 
complexity. For example, the celebrated Miller-Rabin algorithm [H] for test- 
ing primality of the given odd natural number n in nothing else but a black 
box algorithm for solving the verification problem for the multiplicative group 
Z/nZ* of residues modulo n (given by a simple black box: take your favorite 
random numbers generator and generate random integers between 1 and n) and 
the cyclic group Z/(n — 1)Z of order n — 1 as the target group. On the other 
hand, ii n — pq is the product of primes p and q, the recognition problem for 
the same black box group means finding the direct product decomposition 

Z/nZ* = Z/{p - I)Z © Z/{q - 1)Z 

which is equivalent to factorization of n into product of primes. 

The next step after finding the isomorphism type of the black box group X 

is 

Constructive Recognition. Suppose that a black box group X encrypts a 
concrete and explicitly given group G. Rewording a definition given in 

[Tg, 
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The goal of a constructive recognition algorithm is to construct 
an effective isomorphism : G — > X. That is, given g £ 
G, there is an efficient procedure to construct a string VE'((/) 
representing g in X and given a string x produced by X, there 
is an efficient procedure to construct the element 'i/~^{x) G G 
represented by X. 

However, there are still no really efficient constructive recognition algorithms 
for black box groups X of (known) Lie type over a finite field of large order 
q=p'^. The first computational obstacles for known algorithms [T51 [T51 [HI [T71 
[151 [HI [22l |3T] are the need to construct unipotent elements in black box groups, 
[TOl [T51 [HI [T71 [T51 [15] or to solve discrete logarithm problem for matrix groups 

[1I1[11[SI]. 

Unfortunately, the proportion of the unipotent elements in X is 0(l/g) |27] . 
Moreover the probability that the order of a random element is divisible by p is 
also 0(l/g), so one has to make 0{q) (that is, exponentially many, in terms of the 
input length 0(log q) of the black boxes and the algorithms) random selections of 
elements in a given group to construct a unipotent element. However, this brute 
force approach is still working for small values of g, and Kantor and Seress [29] 
used it to develop an algorithm for recognition of black box classical groups. 
Later the algorithms of |29| were upgraded to polynomial time constructive 
recognition algorithms [141 [TBI [TTl [TS] by assuming the availability of additional 
oracles: 

• the discrete logarithm oracle in F*, and 

• the S\j2{q)- oracle. 

The latter is a procedure for the constructive recognition of SL2(<?); see 
discussion in 15, Section 3]. 

Structure recovery. Suppose that a black box group X encrypts a concrete 
and explicitly given group G. A weaker, but frequently feasible and very 
useful version of constructive recognition is what we call structure recov- 
ery: construction of a probabilistic polynomial time morphism 

* : G — > X. 

That is, given g G G, there is an efficient procedure to construct a string 
^'(g) representing g in X — but we do not require that the map ^' can be 
efficiently reversed. 

Structure recovery of black box groups encrypting Chevalley groups in odd 
characteristic is the principal aim of papers O [Tj (H [10], the present paper 
prepares some scaffoldings for this work. A more detailed discussion of method- 
ological issues could be found in jT] [8] . 
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1.3 Results of the paper 



This paper is the first in the series of works [5J[71IHlini[in] directed at development 
of polynomial time methods of computing in black box groups without seeking 
help from any kind of oracles. 

As we have already mentioned, for sake of compactness of exposition in this 
paper we do not make a notational distinction between a black box and the 
group encrypted by it. However, in view of the use of results of this paper 
in subsequent work we carefully underly this distinction in the statements of 
results. 

As the first step, we find unipotent elements in black box groups of Lie type 
of small odd characteristic. 

Theorem 1.1. Let X he a black box group encrypting a quasi- simple group of 
Lie type of odd characteristic p over a field of size q = p'^ > 3. If p ^ 5 or 7, 
then there exists a Monte- Carlo algorithm which constructs a string representing 
a unipotent element. This algorithm works in time polynomial in the Lie rank 
n of X and log q, and is quadratic in p. 

The same result holds if p = 5 or 7 and k has a small divisor I, with the 
algorithm running in time polynomial in n and \ogq, and quadratic in p^ . 

Then we extend this result to present an algorithm that constructs the Stein- 
berg generators of the classical groups. The groups (P)SL2(g) can be viewed as 
the starting point of recursion and we first present an algorithm for (P)SL2((7). 

We need to recall the notion of Steinberg generators of (P)SL2(g) as intro- 
duced by Steinberg |40l Theorem 8]. 

Let G = SL2(g). Then, for t e F((?), set 



u{t) 



, h{t) 







, n{t) 







(1) 



where t for h{t) and n{t). It is straightforward to check that 



= v{~s-'^t), uilf^*'^ = u{-~t^) and = n{e). 



Moreover, 

n{t) = u{t)v{-t-^)u{t) and h{t) = n(i)n(-l). 
It is well-known that 

G={u{t),v{t)\te¥{q)), 
see, for example, [18l Lemma 6.1.1]. Therefore, by ([2]) and (jS]), 

G=Ml),/^(t),n(l) |t£F((^)*); 

notice that actually G is generated by three elements 

G^{u{l),h{t)M^)) 

where we can take for t an arbitrary primitive element of the field F^. 
We prove the following. 



(2) 
(3) 
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Theorem 1.2. Let X be a black box group encrypting (P)SL2(g'), where q = 
1 mod 4 and q — for some k ^ 1. Then there is a Monte- Carlo algorithm 
which constructs in X strings u, h, n such that there exists an isomorphism 



$ : X ^ (P)SL2((?) 

with 



1 1 
1 



t 




1 

-1 



where t is some primitive element of the field ¥q . 

The running time of the algorithm is quadratic in p and polynomial in logq. 

Theorem I 1 . 2l deserves some discussion and comparison with the SL2 ((7)-oracle 
as described in [15l Section 3]. 

Notice that ^{h), and $(n) are some Steinberg generators of (P)SL2(?). 

However, not being oracles we do not have an efficient procedure for computing 
isomorphism $, but we exhibit its inverse in our next paper [7]. 

Still, Theorem 11.21 provides sufficient structural information about X to fa- 
cilitate solution of a wide range of natural problems about (P)SL2((?) and other 
black box groups of Lie type and odd characteristic; a detailed discussion of 
applications of Theorems 11.21 and its easy corollary. Theorem 11.31 below, can be 
found in our next paper [S]. 

Theorem 1.3. Let X be a black box group encrypting the group G = {P)SL2{q), 
where q = 1 mod 4 and q = p^ for some fc ^ 1. Then there is a Monte-Carlo 
algorithm which constructs a triple (U,T,w) in X where U is (a black box for) 
a root subgroup in G, T is (a black box for) a maximal torus in G normalizing 
U and w is a representative in Nx{T) of a Weyl group element in G which 
conjugates U to its opposite root subgroup. The running time of the algorithm 
is quadratic in p and polynomial in logq. 

The formulation of Theorem 11.31 reflects another aspect of our approach to 
black box groups: we prefer to manipulate with subgroups (defined in X by 
their own smaller black "subboxes") rather than with individual elements. 

In our next result, we expand Theorem 11.31 to construction of Steinberg 
generators in the Curtis-Tits configurations of classical groups (for discussion of 
the latter, see Sections 12.21 and |2.3|) . We prove the following. 

Theorem 1.4. Let X be a black box classical group encrypting one of the groups 
(P)SL„+i(g), (P)Sp2„(g), ri2«+i(<?) or (P)r2^„(g), where q = l mod 4 and q > 
5. Then there is an algorithm which constructs: 



black boxes for an extended Curtis-Tits configuration {Kq, Ki, . . . , Kn} of 
X: 



• black boxes for root subgroups Ui < Kg; 

a black box for a maximal torus T where T < Nx{Ue); 
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• Weyl group elements wi G Ki, where U^' is the opposite root subgroup of 
Ui in Ki for all £ — 0,1, ... ,n. 

The running time of the algorithm is quadratic in the characteristic p of the 
underlying field, and is polynomial in the Lie rank n of X and log 5. 

The two families of classical groups, (P)SU„(q) and {P)i}2nil)^ ^^"^ ^^t cov- 
ered by Theorem 11.41 They are twisted Chevalley groups whose Curtis-Tits 
presentations are more complicated than these of Chevalley groups, see [151 
Section 2.4], and work within these groups requires additional technical tools. 
However, we know how to develop algorithms for (P)SU„((7) and {P)^l^nil) 
similar to those described in this paper, they will be published elsewhere. The 
corresponding algorithms for exceptional groups will be presented in our next 
paper [TU] . 

Theorem 1 1 . 41 will be used in the subsequent paper [f? to prove a more precise 
result: 

Theorem 1.5. Let X be a black box classical group encrypting one of the groups 
G ~ (P)SL„+i(<7), (P)Sp2„(g), n2n+iiq) or (P)n+Jq), where g = 1 mod 4 and 
q > 5. Then there is a Monte- Carlo algorithm which constructs a polynomial 
time (in p and log q) morphism 

^■.G^X. 

The running time of the algorithm is polynomial in the characteristic p of the 
underlying field, in the Lie rank n of X , and and in logq. 

1.4 Construction of Ccii) in black box groups 

Our algorithms are based on the construction of involutions and their central- 
izers in black box groups. In this subsection we summarize these constructions 
following [4], see also 1%. 

Let X he a, black box group having an exponent E = 2^m with m odd. To 
produce an involution from a random element in X, we need an element x of 
even order. Then the last non-identity element in the sequence 

_L ~t — iXj ^ tt' ^ tXj ^ ■ ■ ■ ^ tAj ^ tXj -i- 

is an involution and denoted by i(x). Note that the proportion of elements of 
even order in classical groups of odd characteristic is at least 1/4 [55]. 

Let i be an involution in X. Then, by [H Section 6], there is a partial map 
C = Co LI Ci defined by 

C-.X CxW 

_^ ^ r Ci(a;) = -x"! ifo(M^)isodd 

\ Co (a;) = \{ii^ ) if o{ii^ ) is even. 

Here o{x) is the order of the element x E X . Notice that, with a given 
exponent E, we can construct Co (2:) and C,i{x) without knowing the exact order 

of M^. 
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The following theorem is the main tool in the construction of ccntralizcrs of 
involutions in black-box groups. 

Theorem 1.6. ([4]) Let X be a finite group and i (z X he an involution. If the 
elements x 6 X are uniformly distributed and independent in X , then 

1. the elements Ci{x) are uniformly distributed and independent in Cx{i) and 

2. the elements Co{x) form a normal subset of involutions in Cx{i)- 

By Theorem 11.61 we shall use the map Ci to produce uniformly distributed 
random elements in Cx{i)- For an arbitrary involution i d X where X is a 
finite simple classical group, the proportion of elements of the form ii^ which 
have odd order is bounded from below by c/n where c is an absolute constant 
and n is the Lie rank of X [38 . For the classical involutions in classical groups, 
such a proportion is proved to be bounded from below by an absolute constant 
gU Theorem 8.1]. 

1.5 GAP code and experiments 

All algorithms described in this paper have been implemented in GAP 26 and 
thoroughly tested. It is worth noting that our methodology of building internal 
structure of a black box group block-by-block, in an organized and directed 
way, allows us to write (and write quickly!) clean, transparent, compact GAP 
codes; not surprisingly, de-bugging is also much easier than in the "elementwise" 
approach. 

For the efficiency in practice we want to note that the algorithm in Theo- 
rem [T2] for the group SL2(7^°) constructs the unipotent, toral and Weyl group 
elements in around 20 seconds in 2008 model standard MacBook. 

1.6 Notation 

The notation is standard and mostly follows 25 . In particular, 

• (P)SL„(g) denotes any group SLn{q)/N where is a subgroup of the cen- 
ter of SL„(q), with similar conventions for the remaining classical groups. 
In particular, (P)SL2((j') denotes one of the group PSL2(<7) or SL2{q); 

• pi^SL„(g) denotes the factor groups of SL„(g) by the subgroup of order 
(2, n) from its center. 

• The groups fl2n+iiq), g > 3, ^ 3 are simple, so we drop (P) in the 
notation for these groups. 
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2 Backgrounds 



2.1 The Curtis-Tits Theorem 

The main identification theorem used in the classification of the finite simple 
groups is so called the Curtis- Tits Theorem which shows that the essential rela- 
tions in the Steinberg presentation are the ones involving Lie rank 2 subgroups 
corresponding to fundamental roots in 11, that is, edges and non-edges in the 
Dynkin diagram. 

Theorem 2.1. (Curtis-Tits, [51 Theorem 27.3]) Let G* he a finite group of 
Lie type. Let E he the root system of G* and (a G S) the corresponding root 
subgroups. Let Yl he a fundamental system in S and for each a € 11 set 

" {Xa, X^ct) ■ 

Assume that \Il\ ^ 3. 

// now G is any group generated hy subgroups Ga (a G H), and if there are 
homomorphisms 

(pa '■ Ga > Ga 

and 

<f}a0 '■ {G*a,G*3) > {Ga^Gfi) 

for all a, /3 G n, which are coherent in the sense that (pap = (/^Pa and 

(l>aP |g*= (/"a 

for all a and P in Yi, then G/Z{G) is a homomorphic image of G* / Z {G*) . 

The system of subgroups {Ga | a G 11} which satisfies conditions of Theo- 
rem [5?T] is usually called a Curtis-Tits system of the groups G. 

2.2 A Curtis-Tits configuration, the single bonds case 

In this series of papers [3 O |H1 HI UHl SI] , we move beyond identification of a 
simple black box group to creation of tools for computing within these groups. 
For that purpose, we will use a modified concept of a Curtis-Tits system, more 
suitable for pin-pointing the internal structure of the given black box group X. 

Let $ be an irreducible root system of rank at least 3 with fundamental 
system 11 and with Dynkin diagram A of one of the types A„ for n ^ 2, £)„ for 
n ^ 3, i?6, i?7, or £'§. Let H* = IT U {— ao} where ao is the highest root in 11 
and A* be the extended Dynkin diagram for 11*. 

Given a black box group X of type A over a finite field of odd prime power 
order p*^ = q > 3, we have constructed in X [5] a Curtis-Tits configuration, that 
is, a system of subgroups Ka = SL2((7) labeled by nodes of A* and satisfying 
the following conditions: 

(a) X = {Ka\a^ A); 
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Figure 2: Extended Dynkin diagrams (and Curtis-Tits systems) of types Eq, E-j 
and -Eg 



11 



(b) \Ko„K[i\ = 1 if a and ji are not connected in A*; 

(c) (i^Q,, Kp) = SL3((7) if a and /3 are connected with a single bond; 

(d) if Za is the involution in the center of Ka then [za, zp] = 1 for ah a, /3 G A*; 

(e) if we form the elementary abelian group E — {za \ a £ A*), then H = 
Cx{E) is an abelian p'-group; 

(f) for all a G A*, the group Ha ^ H D Ka is a maximal split torus in Ka 
and (Ha \ a e A) ^ H; 

(g) the subgroup H normalizes each subgroup Ka for a G A*. 

Definition 2.2. The indexed set of subgroups {Ka \ a G A} which satisfies 
the conditions (a)-(g) above is called a (single bond) Curtis-Tits configuration. 
Similarly, {Ka | a G A*} is called a (single bond) extended Curtis-Tits config- 
uration for X . 

Example 2.3. The following n ~ 1 subgroups Sh2{q) form a Curtis-Tits con- 
figuration in G = SL„((7). 




The following result is an immediate consequence of j2ll Corollary 27.4], 
which is, in its turn, a special case of Theorem 12. II 

Theorem 2.4. Let G be a finite group with a single bond Curtis-Tits configu- 
ration {Ga} over a field of odd order q > 5 corresponding to one of the Dynkin 
diagrams A„, n ^ 2, Dn, n ^ 3, Eq, E-j, or E^. Then G is isomorphic to a 
quasi-simple group of Lie type over F(g) of the corresponding type and {Ga{ 
is the system of root S1j2- subgroups for roots in a system of simple roots 11 
associated with some maximal split torus H of G. 
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2.3 A Curtis-Tits configuration for double bond Dynkin 
diagrams of rank at least 3 




Ko Ki K2 Kr,-2 K^-1 K 



Figure 3: Extended Dynkin diagrams of type Bn and C„ 

Let now A* be an extended Dynkin diagram of one of the types i3„ or C„ for 
n ^ 3, see Figure [3] notice that the labehing of the nodes is chosen so that the 
nodes 1,2, ... ,n form the corresponding Dynkin diagram and the nodes n ~ 1 
and n are connected by a double bond. 

Given a black box group X of type Bn or C„ over a finite field of odd prime 
power order = g > 5, Curtis-Tits configuration, that is, a system of subgroups 
Ka — (P)SL2(q) labeled by nodes of A* and satisfying the following conditions: 

(a) X = {K^\ae A); 

(b) [Ka,Ki3] = 1 if a and f3 are not connected in A*; 

(c) — {Ka,Kfj) = SL3(g) if a and /3 are connected with a single bond; 

— {Ka,Kfj) = (P)Sp4((j') if a and /3 are connected with a double bond; 

(d) if Za and zp are involution in the centers of Ka — = Sh2{q) then 
[zq,z^] — 1. Moreover, there exits an element t E X of order {q — l)/2 
such that (Ki, . . . ,Kn-i) < Cx{t) and [zo,t] = = 1. 

(e) if we form the abelian group 

E = {za,t I a G A* and Ka = SL2((j)}, 
then H = Cx{E) is an abelian p'-group. 

(f) for all a G A*, the group Ha = H D Ka is a maximal split torus in Ka 
and (Ha | a G A) = iJ; 
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(g) the subgroup H normalizes each subgroup Ka for a e A*. 

Remark 2.5. From the algorithmic point of view, we shall note here that if 
X = (P)Sp2„((z) and q = 1 mod 4, then the element t ^ X oi order {q — l)/2 in 
(d) above can be chosen to be an involution (or a pseudo-involution - an element 
of order 4 whose square is a central involution when X is not simple). The 
restriction q > 5 is imposed due to the following fact for the groups of type Bn- 
Note first that ii X = il2n+iiq), then C = Cxizo, zi, . . . , z„-i) is a subgroup of 
order ^^^^^p—.2"-, which is not abelian. Here, the subgroup of order 2" arises from 
the graph automorphisms and the inversions in the corresponding centralizers 
of involutions. Therefore, if q = 5, then the element t becomes an involution 
since its order is (5 — l)/2 = 2 and it centralizes the subgroup of order 2". We 
shall also note that such an element t corresponds to an involution of type 
that is, Cx{t) has a semisimple component isomorphic to r2j„(q), and if g > 5, 
then Cx{t) has a semisimple component isomorphic to SL„(q). Thus, if g = 5 
then C — Cx{zo, zi, . . . , Zn-i, t) is not a maximal split torus. However, in the 
case of groups of type i?„, the black box group algorithm for the construction of 
a Curtis-Tits configuration does not depend on such an element t ^ X. We also 
note here that the Curtis-Tits configuration above for the groups (P)Sp2„(5) 
also holds. For (7 = 3, however, the methods used in the construction of Curtis- 
Tits configurations in [5] do not work as SL2(3) is solvable. Hence it is enough 
to assume that g > 3 for the algorithmic applications. We refer the reader to [51 
Section 8] for the details about the construction of Curtis-Tits configurations in 
black box classical groups. 

Similarly to Theorem 12. 4[ the following result is an easy consequence of 
Theorem [211 

Theorem 2.6. Let G he a finite group with an extended double bond Curtis-Tits 
configuration {Gq,} over a field of odd order g > 5 corresponding to one of the 
extended Dynkin diagrams i?„ or Cn (n ^ 3). 

Then G is isomorphic to a quasi-simple group of Lie type over ¥{q) of the 
corresponding type and {Ga \ d G A} is the system of root S1j2- subgroups for 
roots in a system of simple roots H associated with some maximal split torus H 
ofG. 

Perhaps it is time to comment on subtle differences between the Curtis- 
Tits configurations in groups (P)Sp2„ of type C„ and in groups ri2n-i-i and 
Spin2„+i of type B„. Indeed some confusion could be created by the fact that 
PSp4(g) = fl5{q) and Sp4(q) = Spin5(g). However the root (P)SL2-subgroups 
Kn-i and Kn in {Kn-i, Kn) = (P)Sp4(q) correspond to roots of different length, 
and therefore correspond to homomorphisms S\j2{q) — > (P)Sp4(g) which are 
not conjugate in Aut (P)Sp4((j'). 

In particular, 

• If Kn = PSL2(g) then {Kn-i,Kn) = PSp^iq) ^ n^iq) and G ^ r!2„+i(g); 
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. if - SL2(g) then {K^-i,K^) - Sp4(g) ^ SpingCg) and G ^ (P)Sp2„(g) 
or Spin2„^x('?)i that case, further information comes from the behaviour 
of the involution z„ € Z{Kn): 

— if z„ e Z{G) then G = Spin2„_|_i((7); 

- if z„ ^ Z(G) then G 9S (P)Sp2„(g). 

Actually the distinctions between the cases of PSp2„, Sp2„, f^2n+i and 
Spin2„_|.i become clear at early stages of construction of an extended Curtis-Tits 
configuration [411 13] and therefore any potential confusion is easily avoidable. 

Indeed, before we start constructing Curtis-Tits system for a classical group, 
we construct a long root SL2(<7)-subgroup K and check whether, for a random 
element g e G, {K,K3) is 

• SL4((j), 

• Sp4(q), 

• SU4((j), or 

• SO+(<z). 

This is the case with probability at least 1 — 0{l/q) provided that the rank is 
big enough if G is SL„(g), Sp2„((j'), SU„(q) or an orthogonal group, respectively. 
This is Theorem 7.1 in [5], and Theorem 7.2 of the same paper presents an al- 
gorithm which computes the type of the group (not distinguishing the groups of 
type Bn and -D„). The differences between Sp2„((z) and PSp2„(g), and r22n+i('z) 
and Spin2„^]^(q) is quite clear as one of them has a central involution and the 
other does not have such an involution. 

3 Steinberg generators of (P)SL2(g') 

Let G = PSL2(q) and q = 1 mod 4. In this section we construct, in G, a unipo- 
tent element u, a Weyl group element w which conjugates u to its opposite and 
the split torus T < G which normalizes the root subgroup U containing u. Note 
that all of this construction can be done in SL2((;) with obvious modifications 
in the arguments. 

Remark 3.1. It is well-known that the non-trivial elements of G = PSL2(q) 
are either semisimple or unipotent. Moreover, any non-trivial semisimple (or 
unipotent) element belongs to a unique maximal torus (or root subgroup). 

Lemma 3.2. Let G = Y"SL2{q), 9 = 1 mod 4 and q ~ for some k ^ 1. If 
i £ G is an involution, then there exists g £ G such that ii^ has order p. 

Proof. Since q = 1 mod 4, any involution in G belongs to a torus of order 
(g — l)/2. Assume that i e T for some torus T < G. By Remark 13. 1[ T is 
uniquely determined by the involution i. Moreover, there are exactly two Borel 
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subgroups Bi and B2 which contain T. If Bi = T k U and B2 = T k V , then 
U and V are opposite unipotent subgroups of G. Now observe that — 
for any u G U (or u ^ V), which imphes that the element ii" has order p and 
the lemma follows. □ 

Lemma 3.3. Let G = PSL2(<7), q = 1 mod 4 and q = p'' for some k ^ 1. For 
any involution i ^ G, the probability that ii^ has order p for a random element 
g Cz G is at least 1/q. 

Proof. Normalizers of unipotent subgroups of order g in G are Borel subgroups, 
and it is well known that any two distinct Borel subgroups intersect over a 
maximal torus of order {q — l)/2. Since q = 1 mod 4, this torus contains an 
involution, uniquely determined by this involution and normalizes exactly two 
unipotent subgroups of order q — see proof of Lemma 13.21 Hence there are only 
two unipotent subgroups U, V of order q which are normalized by i. 

Unipotent subgroups U and V are also normalized by the torus T containing 
i, and are the opposite unipotent subgroups of each other in the sense of the root 
system associated with the torus T. Since Gg{U) = U, all involutions of the 
form i^, g € G, which invert U lie in the coset Ui. By considering the opposite 
unipotent subgroup V, we have 2{q — 1) involutions of the form i^, g G G, such 
that ii^ is an element of order p. Since |G| = q{q^ — l)/2, the proportion of the 
elements g & G such that ii^ is of order p is 

2(.-l) (^_^^^4(^^1 



g((z2-l)/2 ' qiq+1) q 

□ 

Lemma 3.4. Let G ^ PSL2(g) and q = 1 mod 4. Assume that i E G is an 
involution and u — ii^ is a unipotent element for some g G. Ifi^T for some 
torus T and U is a root subgroup containing u, then T < Nq{U). 

Proof. Since it* — u^^, we have i £ Ng{{u)). Moreover, since Ng{U) contains a 
torus and « £ T, by Remark [3.1[ we have T < Ng{U) and the lemma follows. □ 

Lemma 3.5. Let G = PSL2((/) and U < G be the root subgroup containing 
a unipotent element m G G. Assume also that T — (t) is a maximal torus in 
NciU). Then {u,t) — Ng(U). In particular, U is the derived subgroup of {u,t). 

Proof. It is well-known that [/ is a minimal normal subgroup of Ng(U) = TU. 
Hence the lemma follows. □ 

Remark 3.6. Let G = PSL2(q) and q = 1 mod 4. Let T be a torus of order 
{q — l)/2 containing an involution i. Then Gcii) = T x (j) where t^ ~ t~^ for 
all t € T. Observe that if t/ is a root subgroup normalized by T, then is the 
opposite root subgroup of U in G, that is, G = {U, [/■'), see [fS] Lemma 6.1.1 
and 7.2.1]. We will call the element j a Weyl group element. 
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It is well-known that any two maximal tori of fixed order in PSL2((j') are 
conjugate. The following lemma will be used to find a conjugating element for 
a given two tori of order {q — l)/2 in PSL2(g'). 

Lemma 3.7. Let G = PSL2{q) and q = I mod 4. Assume that Ti,T2 be two 
tori of order (g— l)/2 in G, andii,i2 are the involutions inTi,T2, respectively. 
Assume also that \iii2\ = m is odd. Then — T2 where z = (iii2)^™^^-*^^- 

Proof. Assume first that q > 5. Lot D = (?'i,«2), then I? is a dihedral group of 
order 2m and if = i2. Since Cg(«i) = Ti xi (ji) and 6*0(12) = T2 x (^2) where 
ji and j2 are involutions inverting Ti and T2, respectively, we have 

T2 X (j2) = Ccfe) = Cg(zD = CaiiiY = Tl x (ji)^ 

Since there is only one cyclic group of order [q — l)/2 in T2 x {j2)i we have 
T2 = Tf . If g = 5, then Ti = (ii) and T2 = (^2). Therefore, Tf = T2 and the 
lemma follows. □ 



4 An algorithm for PSL2(g) 

Let G ^ PSL2((7) and t G G be an clement of order {p ± l)/2 where {p ± l)/2 
is even. Let s G {t) be an involution, r G G an involution which inverts t, 
and a; G G an element of order 3 which normalizes (s,r). The subgroup L = 
(s, r, x) = Alt4 plays a crucial role in our algorithm. Observe that the prcimagc 
of the elements s and r in G = SL2 {q) generate the quaternion group Q of order 
8 so the preimage of L = (s, r, x) is a subgroup of N^{Q). 

Lemma 4.1. Assume that G = PSL2(<7), q — p'^ for some fc > 2 and t € G 
is an element of order {p ± l)/2 where {p ± l)/2 is even. Let s G (t) be an 
involution, r G G an involution which inverts t, and x € G an element of order 
3 which normalizes (s,r). Then, except for p = 5,7, we have {t,x) = PSL2(p). 
Moreover, if a divides k and t is of order (p" ± l)/2 where (p" ± l)/2 is even, 
then {t,x) ^ PSL2(p°). 

Proof. Let L = {s,r,x) = Alt4 = PSL2(3). Observe that L is a subgroup of 
some H ^ G where H = PSL2(p). Since s = t"^ for some m ^ 1, i G Cg{s) 
and t is contained in a torus T of order {q ± l)/2 in Gg(s). Now T Ci H has 
order {p± l)/2. Since T is cyclic, it has only one subgroup of order (p± l)/2 so 
t G H. Thus {t,x) ^ H. By the subgroup structure of PSL2(p), the subgroup 
L is either a maximal subgroup of H or it is contained in Sym4 < H. Hence, 
if \t\ ^ 5, or equivalently, p ^ 9 then we have {t, x) = H since L does not 
contain elements of order bigger than 5. As we noted above, if p = 3, then 
L ^ Alt4 ^ PSL2(3). 

Observe that if a divides k and \t\ — {p°- ± l)/2, then t belongs to a subgroup 
H = PSL2(j3''). Assuming that (p" ± l)/2 is even, the lemma follows from the 
arguments above. □ 
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Remark 4.2. Following the notation of Lemma HTTl observe that if p = 5, then 
s — t, and if p = 7, then \t\ — 4 and (i, x) = Sym4. Therefore, in these cases, we 
have {t,x) ^ PSL2(p). It is clear that if G = SL2(g), then, by considering the 
pseudo-involutions (whose squares are the central involution in G), the same 
result in Lemma 14.11 holds. Note that, in this case, we consider the elements 
t G G of order p ±1 where (p ± l)/2 is even. Similarly, following the notation 
in Lemma WH if p = 5 or 7, then {t, x) ^ SL2(p). 

The following lemma is concerned with the construction of the element of 
order 3 in Alt4 ^ PSL2(g). Let V = {1, ii, 12, 13} be a subgroup of G isomorphic 
to Klein 4-group. For any random element g G G, denote je = for £ = 1,2, 3. 

Lemma 4.3. Together with the setting above, assume that ti ~ iij2 has odd 

order mi. Set ui — t^ ^ and k = ir^ ^ . Assume also that t2 — i2k has odd 

order m2 and 1*2 = t2 ^ • Then the element x — gu^ permutes «i,i2,*3- 
In particular, x G Ng{V) ^ Sym4 and x has order 3. 

-1 

Proof. Observe first that i\^ — j2 and i^^ — k. Then, since k — ig"^ , we 

have = ig""^ . Hence 12 = ig"^ — if. Now, we prove that if = ii. 

-1 -1 -1 -1 

Since z| — j2 and ~ ii, we have if — 13"^ — ii^ ■ We claim that 

^2 G GG(ii), which implies that 1*2 G GG(ii), so i| = i"'^ = ii. Now, since 

-1 

12 G GG(ii), t2 = i2k G GG(ii) if and only ii k = ig"^ G GG(ii). Recall 
that = j2. Therefore k G GG(ii) if and only if if G Gg (J2) = Cciil), 
equivalently, is G GG(i2) and the claim follows. It is now clear that if = is 
since iii2 — i^. □ 

Lemma 4.4. Let ti and t2 be as in Lemma 14.31 Then the probability that ti 
and t2 have odd orders is bounded from below by 1/2 — l/2g. 

Proof. Notice that all involutions in G = PSL2((j) are conjugate. Therefore the 
probability that ti and t2 have odd orders is the same as the probability of the 
product of two random involutions from G to be of odd order. 

We denote by a one of these numbers {q ± l)/2 which is odd and by b the 
other one. Then |G| = q{q-^ — l)/2 = 2abq and |GG(i)| = 2b for any involution 
i £ G. Hence the total number of involutions is 

|G| _ 2abq _ 

Now we shall compute the number of pairs of involutions (i,j) such that 
their product ij belongs to a torus of order a. Let T be a torus of order a. Then 
Ng{T) is a dihedral group of order 2a. Therefore the involutions in Ng{T) form 
the coset Ng{T)\T since a is odd. Hence, for every torus of order a, we have 

pairs of involutions whose product belong to T. The number of tori of order 
a is |G|/|A''g(T)| — 2abq/2a — bq. Hence, there are bqa"^ pairs of involutions 
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whose product belong to a torus of order a. Thus the desired probabihty is 

bqa^ _b q-1 _1 1 
(ag)2 ~ q 2q ^2^2^' 

□ 

Remark 4.5. An important part of our algorithm is to find a generator of a 
torus T of order {q ± l)/2 in PSL2(<7). However, since finding the exact order 
of an element involves factorization of integers into primes, we consider the 
elements t € T where the order of t is divisible by some primitive prime divisor 
of {q ± l)/2. On the other hand, by [33l 1.8], the proportion of the elements of 
order (q ± l)/2 in T is 0(1/ log log g). 

A prime number r is said to be a primitive prime divisor of — 1 if r divides 
p'^ — 1 but not — 1 for 1 ^ i < fc. By [43 , there exists a primitive prime 
divisor of p*^ — 1 except when (p, fc) = (2, 6), or fc = 2 and p is a Mersenne prime. 
Observe that the all of the primitive prime divisors of p^'^ — 1 divide p'^ + 1. 
Therefore the primitive prime divisors of p*^ + 1 are defined to be the primitive 
prime divisors of p'^'^ — 1. Here, we shall note that the Mersenne primes which 
are less than 1000 are 3, 7, 31, 127. 

For the practical purposes of our algorithms, we shall be dealing with small 
primes, for example the primes less than 1000. Assume that q = 1 mod 4 and 
q = p^ for some prime p. If fc = 1, then we can assume that the factorization 
into primes is possible and we can check whether a given element has order 
{p ± l)/2. If fc ^ 2 and q is big, then we can not use factorization of integers 
into primes to find exact orders of elements. In this case, if p = 1 mod 4, then 
we look for an element i G T which satisfies 

tp"-^ = 1, ^nt-.^b'-i) ^ 1. 

Moreover, we also need that the element t p-i has order [p — l)/2. li p = 
— 1 mod 4, then we look for the elements t G T satisfying 

and the element t p+i has order (p + l)/2. Note that the prime factorization of 
p±l can be computed in 0{p) time. It follows from [29] Lemma 2.6] that there 
exists a primitive prime divisor of p^ ± 1 which divides the order of t. 

Proof of Theorem Let G be a simple black box group of Lie type of odd 
characteristic p. Assume first that p ^ 5, 7. If G ^ PSL2(g) or '^G2{q), then we 
construct a long root SL2((j)-subgroup L of G by [HJ Theorem 1.1]. Now by 
Lemmas |4 . 1 [ 14 . 31 and Remark IT^ we construct a subgroup K ^ L = SL2(q) 
where K ~ SL2(p). By [37], the proportion of the unipotent elements in K is 
0{l/p). Therefore, we can find a unipotent element from randomly chosen 0{p) 
elements in K. If G = ^G2{q), then Ccii)' — PSL2(q^) for any involution i G G. 
Therefore, by the same arguments above, we can construct unipotent elements 
in '^G2{q) and PSU{q). 
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Assume now that p = 5 or 7. If q — p'' and k has small prime divisor r. 
Then, again by the arguments above, we can construct a subgroup isomorphic to 
(P)SL2(p'") and perform random search in this subgroup to construct a unipotent 
element. In this case the probability of finding a unipotent element is 0{l/p^). 

□ 

Algorithm 4.6. Let G be a black box group isomorphic to PSh2{q) where q = 
1 mod 4 and q — p^ . 

Input: • A set of generators of G. 

• The characteristic p of the underlying field. 

• An exponent E for G. 

Output: • A root subgroup U ; 

• The maximal torus T normalizing U ; 

• A Weyl group element w where is the opposite root subgroup of 
U. 



Outline of Algorithm 14.61 (a more detailed description follows below) : 

1. Find the size of the field q. 

2. Construct a Klein 4-group V = {i^j) \nG together with the torus T where 
i € T and j inverts T. 

3. Construct an element of order 3 in Na{V). 

4. Construct H = PSL2(p) or PSL2(p^) if p = 1 mod 4 or p = -1 mod 4, 
respectively. 

5. Construct a unipotent element it G -ff of the form u = ii^ for h d H and 
conclude that the torus T which contains i is a subgroup of Ng{U) where 
U is the root subgroup containing u and j is the corresponding Weyl group 
element. 



Now we give a more detailed description of Algorithm 14.61 
Step 1: We compute the size q of the underlying field by Algorithm 5.5 in [42] . 



Step 2: Let E — 2^m where (2, m) = 1. Take an arbitrary element g ^ G. If 
the order of g is even, then the last non-identity element in the following 
sequence is an involution 

Note that the probability of finding an element of even order in the groups 
of Lie type of odd characteristic is at least 1/4 by [28l Corollary 5.3]. Let 
I G G be an involution constructed as above. Then, we construct Cg(i) 
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by the method described in [H [T2] together with the result in [3S] . We 
have Ccii) = T x {w) where T is a torus of order {q — l)/2 and w is an 
involution which inverts T. We fohow the arguments in Remark 14.51 to 
find a toral element t G T where \t\ is divisible by {p — l)r if p = 1 mod 4, 
or {p^ — l)rifp = — 1 mod 4 where r is a primitive prime divisor of (g — 1) . 
Note that t has order {q — l)/2 with probability at least 0(1/ log log g). 
Note also that the coset Tw consists of involutions inverting T. Hence we 
can find an involution j G Ccii) which inverts T with probability at least 
1/2. Now it is clear by the construction that V — is a Klein 4-group, 
i Cz T and j inverts T. 

Step 3: Let ii — i, i2 — j, is = Then we search for an element g € G such 

that <i := 11^2 has odd order mi and t2 '■— 42*3"^ has odd order m2 where 

ui — ^ . By Lemma [4.41 we can find such element g £ G with proba- 
bility at least 1/2 - l/2g. Now, by Lemma l43l x gu^^u^^ G Ng{V) 

has order 3, where ^2 = ^2^ • 

Step 4: Let T = (t) be the torus constructed in Step 2 and x the element 
of order 3 constructed in Step 3. By Lemma 14.11 if p = 1 mod 4, then 
H = {t',x) ^ PSL2(p) where t' € T, \t'\ = (p- l)/2. If p = -1 mod 4, 
then H = {t',x) = PSLs^^) where t' e T and \t'\ = {p^ - l)/2. 

Step 5: Notice first that i £ H . Assume that H = PSL2(p) and p = I mod 4. 
Then, by Lemma 13.31 we can find an element g H with probability at 
least 1/p such that u = ii^ is a unipotent element in H. Since i € T (see 
Step 2), by Lemma |331 T < Ng{U) where U is the subgroup containing u. 
Note that we can construct the root subgroup U by Lemma [?3] Moreover, 
by Remark 13. 6i the element j constructed in Step 2 is the corresponding 
Weyl group element. 

If p = —1 mod 4, then, in Step 4, we construct H = PSL2(p^). Following 
the same arguments above, we construct a unipotent element of the form 
u = ii^ for some g E H with probability at least 1/p^ and the rest of the 
construction is the same as above. 

Notice that algorithms described in this and previous section provide a proof 
of Theorems O and O 

5 Construction of a maximal split torus 

Let G be a quasi-simple classical black box group of odd characteristic iso- 
morphic to (P)SL„+i(g), (P)Sp2„((z), (P)1^2„+i(9) or {P)^tnil)- Assume that 
{Kq, Ki, . . . , Kn} is an extended Curtis-Tits configuration of G. 
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In this section, for any odd g > 3, we describe a method constructing the 
spht tori < iff, i = 0,1, . . . ,n, which all together generate a maximally split 
torus 

T= (Tfe I fc = l,2,...,n) 

in G normalizing Ki for all e {0, 1, . . . , n}. We set that Kq is the root SL2(g)- 
subgroup of G corresponding to the extra node in the extended Dynkin diagram 
of G. 

Note that an extended Curtis- Tits configuration of G can be constructed 
by using the algorithm in [5] except that G = (P)Sp2„(<z) and q = —1 mod 4. 
Therefore, we assume that g = 1 mod 4 if G = (P)Sp2„(q). 

5.1 Groups of type 

Assume that G = (P)SL„+i((3'), q > 3, n ^ 2. Note that, for each i = 0,1, . . . ,n 
(see Figure [T]), Kg = SL2(g). Assume that ig G Kg is the unique involution for 
each £ = 0,1, . . . ,n. 
We set 

• To = CKoih) = CKo{in), 

• Ti = CKi{i2), 

• Te = GKt{i£-i), £ = 2,...,n. 

Lemma 5.1. We have \Te\ = q — 1 for each £ ^ 0,1,2, ... ,n. 

Proof. Recall that the involutions ii, i — 0,1, ... ,n, mutually commute with 
each other. Observe that ik G Ng{Ki) for all fc, ^ = 0, 1, . . . , n and it^i acts as 
an involution of type ti on Ki Iot: i = 2, . . . ,n. Hence \Ti\ — \Gki,{h-i)\ =9 — 1 
for £ = 2,2), . . . ,n. The other cases are analogous. □ 

Lemma 5.2. The subgroup {Tq,Ti, . . . ,r„) is a maximally split torus normal- 
izing Kf for each £ — 0,1, . . . ,n. In particular, (Tq, Ti, . . . , r„) = (Ti, . . . , T„). 

Proof. By Lemma |5.1[ we have jT^j = q — 1 for each £ — 0,1,..., n. We 
shall prove that TiS are mutually commuting with each other. We prove 
that [Ti,T2] — 1 and the other cases are treated similarly. Consider L = 
{Ki,K2) = SU{q)- Then, by (25l Theorem 4.5.5 (c)], Ci,(i2) = Nl{K2). 
Therefore Ti = Gki{T'2) normalizes K2. Thus Gk2{Ti) is a torus in K2. Since 
Cif2(ii) is also a torus in K2 we must have T2 = GKzih) = Ck2{Ti). Thus 
[Ti,T2] = 1. In a similar manner, we have [Tk,Ti\ = 1 and T^ ^ Nq{Ki) for 
each k,£ = 0,1, so T — {Ti, . . . T„) is a maximally split torus normalizing 
for each £ — 0,1, ... ,n. Since Tq commutes with Ti for each £ — 1, . . . ,n, 
we have Tq ^ Cg((Ti, . . . , T„)) = (Ti, . . . , r„}. □ 
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5.2 Groups of type C„ 

Assume that G = PSp2„(g), n ^ 2, q ee 1 mod 4. Let S = {i^o,-f'^i, • • • ,^n} 
be an extended Curtis- Tits configuration of G. By Remark 12.51 we can take 
an involution j £ G (necessarily of type <„) such that GqU) — where 
L = {Ki, . . . ,Kn-i) = Coij)" = (2^8^1(5) and D is a dihedral group of 
order 2{q — 1). Note that if G = Sp2„(g), then j is a pseudo-involution, L = 
SL„(q) and D is a torus of order q — 1. Note also that if G = PSp4((7), then 
Ki = PSL2(q), i^To = if 2 — SL2((7) and in aU the other cases = SL2{q) for 
each £ — 0,1, . . . ,n. 



Ko Ki K2 
Figure 4: Extended Dynkin diagram of G2 



Remark 5.3. Since {Kq, Ki, . . . , Kn} is a Curtis-Tits configuration of G = 
(P)Sp2„(<?), the element j E G chosen above has the property that j G NciKi) 
for all i = 0, 1, . . . , n. 

We set 

• To = CkoU) s-iid Tn = CK„{j) where j is as above. 

• If n = 2, then Ti is the cyclic subgroup of order {q~l)/2 in Gk^ (io) where 
io e Z{Ko). 

• If n > 3, then Ti, . . . , r„_i are as described in Subsection l5.ll 

Lemma 5.4. Let G ^ (P)Sp2„((?) and q = I mod 4. T/ien {To,Ti, . . . jTa) ?s 
a maximally split torus normalizing Ki for each ^ = 0, 1, . . . , n. In particular, 

(To,ri,...T„) = (ri,...T„) 

Proof. We first assume that G = PSp4(g). Then Kq = K2 = SL2((7) and 
= PSL2(q), (see Figure H). We shall show that T = {To,Ti,T2) is abelian. 
By the setting above, it is clear that [To,T2] = 1. Moreover, iq G GqU) and 
*o G Nc{Ki) where io S Z{Kq) since {i^o, i^i, ^^2} is a Curtis-Tits configuration 
of G. Now Ti < G^i (io) — Gki {Tq) = Cki {T2) since To and T2 are cyclic groups 
and ioGTonT2. Hence [Ti,Tq] = [Ti,T2] = 1. 

We have Tq = Ck,, (j) ^ Caij) = Ng{Ki). Similarly, we have T2 ^ Ng{Ki). 
Observe that GkA^o)' < Cg(«o)' = A^G(ifo) = Ng{K2) and jTi : Gif,(io)'| - 2 
so Ti ^ Ng{Ko) = Ng{K2). Thus, Tq, Ti and r2 normalize A'o, Ki and if2- 
Moreover, since Tq commutes with Ti and T2, we have Tq ^ Gg{{Ti,T2)) = 
{Ti,T2). 
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Now we assume that G = '&\>^{q) or (P)Sp2„(g), n > 3. We first show 
that {To,Ti, . . . ,Tn) is abelian. By Lemma [5.21 observe that it is enough to 
show that [To,Ti] = [r„_i,T„] = 1. We show that [To,Ti] = 1 and the other 
case is analogous. Consider L = {Kq.Kx) ^ Sp4((7). Since {Ki^, Ki, . . . , Kn} 
is a Curtis- Tits configuration of G, we have Cl(«2) = CL(io) — Ko x Kq for 
some Kq = Sh2{q), and io,i2 act as an involution of type ti on Ki. Therefore 
CKiiio) — CKi{i2) — Ti. Now since j commutes with Ki and Tq, we have 
KiTo < ClO). Therefore io e Tq Nl{Ki). It follows that Ti = CK^{io) = 
CkATo)- Hence [To,Ti] = 1. 

It is clear that Tq commutes with Ki for each £ = 2, . . . ,n. Therefore, 
since Tq ^ Nl{Ki), we have Tq ^ Ng{Ki) for each £ = 2,. . . ,n. Moreover, 
Ti — CKi{i2) — Cxiiio) ^ CL{in) — Nl{Ko). By similar arguments, we 
conclude that Tfc < Ng{Ki) for all fc, ^ = 0, 1, . . . , n. 

Since To commutes with Tg for each t ~ 1,2, ... ,n. We have 

To < CGi{T,,T2, r„)) = (Ti, Ta, . . . , 
Hence (Ti, Tj, . . . , T„) = (Tq, Ti, T2, . . . , T„) and the lemma follows. □ 

5.3 Groups of type S„ 

Assume that G = fl2n+iiq), q > 3, n ^ 3. Let {Kq, Ki, . . . , Kn} be an extended 
Curtis-Tits configuration for G where Kg, £ = 0,1, . . . ,n — l, correspond to long 
root SL2((j')-subgroups and Kn corresponds to the short root SL2((;)-subgroup 
in the extended Dynkin diagram of G (see Figure [S]). Then Kg = SL2(g) for 
£ = 0,l,...,n-l and Kn^ PSL2((7). We set 

• To = CK„ii2), Ti = GxAi^), 

• Ti^CKt{k-i)A^'^.---,n-l, 

• r„ < CK„{in~i) where r„ is an abelian group of order {q — l)/2. 

Lemma 5.5. Let G = fl2n+i{q), n ^ S. Then {Tq,Ti, . . . ,r„) is a maximally 
split torus normalizing each Kg, £ = 0,1, . . . ,n. In particular, (Tq, Ti, . . . , Tn) = 
(Ti,...,T„). 

Proof. Observe that {Ko, K2, . . . , Kn-i) = {Ki, K2, . . . , Kn-i) = SL„(q) and 
{Kn-i, Kn) = PSp4(g). Recall that Kn = PSL2(g) and the involution in^i & 
Kn-i acts as an involution of type ti on Kn so CK„i^n-i) is a dihedral group 
of order q—1. Taking T„ as the abelian group of order {q — l)/2 in Ck„ {in-i), 
the result follows from Lemmas 15.21 and 15.41 □ 

5.4 Groups of type D„ 

Assume that G = (P)il^„(g), g > 3, n ^ 4. Let {Kq, Ki, . . . , Kn} be an 
extended Curtis-Tits configuration for G. Then, for each £ = 0,1,..., n (see 
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Figured]), Kg = SL2{q)- Assume that ig S Kg is the unique involution for each 
£^0,l,...,n. 
We set 

• To = Cko(«2), Ti = Ci<-i(«2), 

• T, = CK,(i,_i),^ = 2,...,n-2. 

Lemma 5.6. Let G = (P)f2j„(g), n ^ 4. T/ien {Tq^Ti, . . . ,Tn) is a maximally 
split torus normalizing each Kg, i? = 0,l,...,n. In particular, (Tq, Ti, . . . , T„) = 

{ri,...,T„). 

Proof. It follows from the extended Dynkin diagram of G (see Figure [T] on 
page[TT]) that 

(P)SL„((7) - {Ko, K2, K3,..., Kn-2, Kn) = {Ki,K2, K3,..., if„_2, K^-i). 
Hence the result follows from Lemma [5.21 □ 

6 Construction of the Weyl group 

In this section, we construct the generators of the Weyl group of a quasi-simple 
classical group G, which correspond to the fundamental reflections in the root 
system of G. 

We assume that q = 1 mod 4 throughout this section. Let {Kq, Ki, . . . , Kn} 
be an extended Curtis-Tits configuration of G. Assume also that Tg < Kg, 
i = 0,1, ... ,n, be the corresponding tori constructed as in Section [3 We 
construct the Weyl group elements wg G Ki as discussed in Remark l3.6l for each 
£ = 0,l,...,n. 

Lemma 6.1. Let wg G Kg be Weyl group elements associated to Tg, that is, wg 
inverts Tg for each i = 0, 1, . . . , n. Then wg G Nq{T) for each i — 0, 1, . . . , n 
where T — (Tq, Ti, . . . , T„). In particular, 

W = {wo, Wi,..., Wn)T/T {wi, Wn)T/T 

is the Weyl group of G. 

Proof. We prove that wi G Ng{T) and the other cases are analogous. Assume 
first that G = (P)SL„(5) and L — (ifi, A'2) = SL3(g). Since Wi inverts Ti and 
[Ti,T2] = 1, we have [T^\T2] = 1 which implies that T^' ^ Cl{Ti) = {Ti,T2). 
Hence wi G Nl{{Ti,T2)). Similarly, wi G Nl{{Ti,Tq)). By the construction 
of Kq, Ki, . . . , Kn, it is clear that wi commutes with Tg for £ ^ 3. Thus wi G 
Ng{T). 

If G = (P)Sp2„((?), then it is enough to consider L — {Ko,Ki) = (P)Sp4(g). 
Then, following the same arguments above, we see that wi G Ng{T). The 
groups of type i3„ and Dn are treated similarly. 

Observe that, in all cases, we have wq G Ng{T) by the same arguments in the 
case G = PSL„(q). Since Ng(T) — {wi, . . . ,Wn)T, we have wq G {wi, . . . ,Wn)T 
and the lemma follows. □ 
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7 Construction of root elements in (P)SL„+i(g) 

Let G = (P)SL„+i(q) and {A'q, Ki,. . . , K^} be an extended Curtis-Tits config- 
uration for G. In this section, we construct unipotent elements uo, ui, ■ • • , u„ in 
i^o, Ki, . . . , Kn where the maximal split torus T — (Tq, Ti, . . . , r„) constructed 
in Section [S] normalizes the root subgroups Ui < Ki containing Ui for each 
^ = 0, 1, 2, . . . , n. Note that Ti < Ki for each £ = 0, 1, 2, . . . , n. 

By Algorithm 14. 6[ we can construct a triple (u, T, w) such that u G Ki = 
SL2(g) is a unipotent element, T < i^i is a torus of order q — 1 normalizing 
the root subgroup containing u and w G Ki is a Weyl group element. By 
Lemmas 13.71 and 14.41 we can find an element g G Ki such that = Ti with 
probability at least 1/2. We set ui = and wi = . Then, it is clear that 
Ti is a maximal torus in Ki normalizing the root subgroup Ui containing ui. 
Moreover wi inverts Ti and J7{" is the opposite root subgroup of f/i. 

For each tori Tq, ^i, . . . , T^, let wo,wi, . . . ,Wn be the corresponding Weyl 
group elements constructed as discussed in Remark 13. 6i then, by Lemma l6.1[ 

W = {W(i,Wi, . . .,Wn)T/T = {wi, . . .,Wn)T/T 

is the Weyl group of G. 

Lemma 7.1. Let G = (P)SL„+i((7). // {wi, . . . , w„} is a set of fundamental 
reflections in the Weyl group WofG. Then 

at = Wi-iWi{ai-i) 

where a,; is the corresponding fundamental root in the root system of G and 
i — 2, . . . ,n. Moreover, 

aa = woWnWo{an)- 

Proof. The proof follows from a direct computation in the structure of the root 
system of type An ■ □ 

Corollary 7.2. Let G ^ (P)SL„+i(g). We have 

Ui — 

for each i — 2, . . . ,n and 

8 The algorithm 

Algorithm 8.1. Let G - (P)SL„+i(g), (P)Sp2„(g), r!2„+i(<?), or (P)17+ (g) 
where q — p^ and q = 1 mod 4. 

Input: • a set of generators for G; 

• the characteristic p of the underlying field; 

• an exponent for G. 
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Output: • An extended Curtis-Tits system {Kq, Ki, . . . , Kn} for G together 
with 

• The root subgroups U{ < Kg for each £ — 0,1, . . . ,n; 

• The maximally split torus 

T — (To, Ti, . . . , Tn) 

where Tk < Nq{Ui) for all k,£ — 0,1, ... , n; 

• The Weyl group elements wi £ Kg, where Uf' is the opposite 
root subgroup of Ug for each I — 0,1, ... ,n and 

{W(i,Wi, . . .,Wn)T/T = {wi, . . .,Wn)T/T 

is the Weyl group of G. 
The details of Algorithm 18. II are as follows: 

1. Construct an extended Curtis-Tits configuration S = {Kq,Ki, . . . ,Kn\ 
of G and find the size q of the underlying field. 

2. Construct a maximally split torus T — {To,Ti, . . . ,Tn) and Weyl group 
elements wo,wi, . . . ,Wn, where Tg ^ Kg and T normalizes Kg for each 
e^O,l,...,n. 

3. Construct a subgroup Hi = SL2(p) or SL2(p^) if p = 1 mod 4 or p = 
— 1 mod 4, respectively, in Ki. 

4. Construct (u, S, w) in Hi, where u is a unipotent element, S" is a maximal 
torus normalizing the root subgroup containing u and u" is a Weyl group 
element which inverts S. 

5. Construct the maximal torus T ^ Ki containing S. 

6. Construct z e Ki such that T"^ = Ti. 

7. Construct the remaining unipotent elements in each Kg, £ = 0,2,3, ... ,n. 

And what follows is a more detailed descriptions of Steps 1-7. 

Step 1: We use the algorithm in to construct an extended Curtis-Tits con- 
figuration 

E^{Ko,Ki,...,Kn} 

of G. We compute the size q of the underlying field by using Algorithm 
5.5]. 

Step 2: We construct a maximally split torus T = (Tq, Ti, . . . , T„) as described 
in Section [5] depending on the type of the group G. Here the construction 
of the tori Tk, fc = 0, 1, . . . , n, means that we find a toral element tk G Tk 
as in Step 2 of Algorithm [521 Moreover, by Remark |3.6[ we can construct 
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the corresponding Weyl group elements wo,wi, . . . ,Wn in Kq, Ki . . . , Kn, 
respectively. By Lemma |6.1[ 

W = {wo,wi, . . .,Wn)T/T 

is the Weyl group of G. 

Step 3: Assume that Ki = PSL2((?). Then this is Step 2, 3 and 4 of Algorithm 
14.61 Observe that the same computations apply for Ki = SL2((j') with ob- 
vious modifications in the arguments as noted in the beginning of Section 

El 

step 4: This is Step 5 of Algorithmic 

Step 5: We continue to assume that Ki = PSL2(g). If i € 5 is an involution, 
then Cxiii) contains a torus T of order {q — l)/2 containing S. It is 
clear that T normalizes the the root subgroup Ui which contains u. We 
construct the root subgroup C/i by using Lemma 13.51 

Step 6: Let Ti and T be the tori constructed in Step 2 and Step 5, respectively. 
Then, by Lemmas 13.71 and 14.41 we can construct an element z S Ki such 
that = Ti with probability at least 1/2. 

Step 7: If G = (P)SL„-|_i((7), then, by Corollarv l7.21 we construct the remaining 
unipotent elements W£ G Kf^ for each ^ = 0,2,. 

If G = (P)Sp2„((?), then, since 

{Ki,.. .,Kn-i) = --^SL„(q) or SL„(g), 
(2,n) 

we can construct unipotent elements U2 £ K2, . . . , m„_i G i^n-i by Corol- 
larv 17.21 To construct uq and u„, we repeat Steps 3, 4, 5, 6 for the groups 
Kq and Kn- It is clear that the unipotent elements uo and u„ are aligned 
with the rest of the unipotent elements since Tq and r„ are aligned with 
the rest of the root subgroups. However, we need to check whether uq and 
Un commute with ui and m„_i, respectively, since uq or u„ may correspond 
to opposite root subgroups in Kq and Kn, respectively. 

If G = il2ji+i('?), then the construction of the remaining unipotent ele- 
ments is similar to the construction of unipotent elements for PSp2„((7). 

If G^ (P)r!+ (g), then 

(Xi,i^2,...,if„-i) = SL„(g). 

Therefore, we can construct unipotent elements U2 E K2,...,Un~i G 
Kn-i by Corollary 17.21 We follow the same arguments in the case of 
(P)Sp2„(g) to construct uq G Kq and it„ G Kn- 

Finally, by Lemma 13.51 we construct the root subgroups Uo,Ui, . . . ,Un for 
each type of the group G. 

Algorithms described in this section provide proof of Theorem 11.41 
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